#!/bin/bash
#功能：防火墙配置，默认保存到/etc/iptables.rules
#iptables -vnL
# pkts:对应规则匹配到的报文的个数
# bytes:对应匹配到的报文包的大小总和
# target:规则对应的target，往往表示规则对应的”动作”，即规则匹配成功后需要采取的措施
# prot:表示规则对应的协议，是否只针对某些协议应用此规则。
# opt:表示规则对应的选项。
# in:表示数据包由哪个接口(网卡)流入，即从哪个网卡来。
# out:表示数据包将由哪个接口(网卡)流出，即到哪个网卡去。
# source:表示规则对应的源头地址，可以是一个IP，也可以是一个网段。
# destination:表示规则对应的目标地址。可以是一个IP，也可以是一个网段。
#1.丢弃 DROP
#2.拒绝 REJECT
#3.放行 ACCEPT
#iptables -t filter -I INPUT -s 192.168.68.0/24  -p icmp -j DROP
#iptables -t filter -D INPUT -s 192.168.68.0/24  -p icmp -j DROP



#备份
if [ ! -f  /etc/iptables.rules.init.bak  ];then 
	if [  ! -f /etc/iptables.rules ];then iptables-save > /etc/iptables.rules;fi
	cp /etc/iptables.rules /etc/iptables.rules.init.bak
fi
#打印当前INPUT
iptables -nL  INPUT --line-numbers|sed 's/DROP/丢弃/g'|sed 's/REJECT/拒绝/g'|sed 's/ACCEPT/放行/g'
echo 

while true
do 
echo '
1.添加规则
2.打印规则
3.删除规则（仅支持序列）
4.保存到开机启动
0.退出

语法：<序列> [地址] [端口1,协议/端口2，端口3 ...] [规则:drop|reject|accept]
添加端口、规则：		1 tcp/80,123,443:445 drop
打印全部：			3 
打印drop规则：			3 drop
打印IP、drop规则：		3 192.168.68.0 drop
注：仅对INPUT表操作,规则：drop(丢弃)|reject(禁用)|accept(放行)！！！
删除：				2 序列号,序列开始:结束
-------------------------------------------------------------------'
read -p "请输入操作：" KEY
if [ -z "$KEY" ];then continue;fi 
KEY1=`echo $KEY|awk '{print $1}'`

case $KEY1 in
		1)
		for i in `echo $KEY|awk '$1=null;{print }'`
		do
		echo $i|grep '\.' >/dev/null
		if [ $? -eq 0 ];then KEY2=$i;continue;fi
		VAR1=`echo $i|grep '/'` 
		if [ ! -z "$VAR1" ];then KEY3="$i";continue;fi
		echo $i|grep -iE 'drop|reject|accept' >/dev/null
		if [ $? -eq 0 ];then KEY4=$i;continue;fi
		done
		echo "---------------------添加配置项---------------------"
		echo "地址=$KEY2  协议/端口=$KEY3  规则=$KEY4"
		read -p "请确认配置项(Y/N)任意键为Y :" YN
		echo $YN|grep -i N >/dev/null
		if [ $? -eq 0 ];then continue;fi
		CMD='-I'
		if [ -z "$KEY2" ];then KEY2_VAR='-1';else KEY2_VAR=`echo "$KEY2"|tr "," "\n"`;fi
		for ii in `echo $KEY2_VAR`
		do
			if [ "$ii" == '-1' ];then 
				IPADD=""
			else
				echo "$ii"|grep '-' >/dev/null
				if [ $? -eq 0 ];then IPADD="-m iprange --src-range $ii";else IPADD="-s $ii";fi
			fi
			if [ -z "$KEY3" ];then MODE='';KEY3_VAR='-1';else MODE="-p `echo $KEY3|awk  -F '/' '{print $1}'`";KEY3_VAR=`echo "$KEY3"|awk -F '/' '{print $2}'|tr '/'  "\n"|tr "," "\n"`;fi
			for iii in `echo "$KEY3_VAR"`
			do
				if [ "$iii" == '-1' ];then PORT='';else PORT="--dport $iii";fi
				echo "执行操作："
				iptables -t filter $CMD INPUT $IPADD $MODE $PORT  -j `echo $KEY4|tr '[a-z]' '[A-Z]'`
				if [ $? -eq 0 ];then echo "Success,添加操作成功：iptables -t filter $CMD INPUT $IPADD $MODE $PORT  -j `echo $KEY4|tr '[a-z]' '[A-Z]'`";else echo "Error!添加操作失败：iptables -t filter $CMD INPUT $IPADD $MODE $PORT  -j `echo $KEY4|tr '[a-z]' '[A-Z]'`";fi

			done
		done
		;;



		2)
		KEY_WC=`echo $KEY|wc -w`
		case $KEY_WC in 
				1)
				iptables -nL  INPUT --line-numbers	|sed 's/DROP/丢弃/g'|sed 's/REJECT/拒绝/g'|sed 's/ACCEPT/放行/g'		
				;;
				2)
				KEY1=`echo $KEY|awk '{print $2}'|tr ',' '|'`
				iptables -nL  INPUT --line-numbers	|grep -iE "$KEY1"	|sed 's/DROP/丢弃/g'|sed 's/REJECT/拒绝/g'|sed 's/ACCEPT/放行/g'

				;;
				3)
				KEY1=`echo $KEY|awk '{print $2}'|tr ',' '|'`
				KEY2=`echo $KEY|awk '{print $3}'|tr ',' '|'`
				iptables -nL  INPUT --line-numbers	|grep -iE "$KEY1" |grep -iE "$KEY2"	|sed 's/DROP/丢弃/g'|sed 's/REJECT/拒绝/g'|sed 's/ACCEPT/放行/g'
				;;

				4)
				KEY1=`echo $KEY|awk '{print $2}'|tr ',' '|'`
				KEY2=`echo $KEY|awk '{print $3}'|tr ',' '|'`
				KEY3=`echo $KEY|awk '{print $4}'|tr ',' '|'`
				iptables -nL  INPUT --line-numbers	|grep -iE "$KEY1" |grep -iE "$KEY2"	|grep -iE "$KEY3"	|sed 's/DROP/丢弃/g'|sed 's/REJECT/拒绝/g'|sed 's/ACCEPT/放行/g'
				;;

				5)
				KEY1=`echo $KEY|awk '{print $2}'|tr ',' '|'`
				KEY2=`echo $KEY|awk '{print $3}'|tr ',' '|'`
				KEY3=`echo $KEY|awk '{print $4}'|tr ',' '|'`
				KEY4=`echo $KEY|awk '{print $5}'|tr ',' '|'`
				iptables -nL  INPUT --line-numbers	|grep -iE "$KEY1" |grep -iE "$KEY2"	|grep -iE "$KEY3"	|grep -iE "$KEY4"	|sed 's/DROP/丢弃/g'|sed 's/REJECT/拒绝/g'|sed 's/ACCEPT/放行/g'
				;;
		esac

		;;


		3)
		KEY_LN=`iptables -nL INPUT --line|awk '{print $1}'|tail -n1`
		KEY_WC=`echo $KEY|wc -w`
		if [ $KEY_WC -eq 1 ];then echo "未输入序列，跳过删除操作！";continue;fi
		KEY_SUM=''
		for j in `echo $KEY|awk '$1=null;{print}'|tr ','  '\n'`
		do
			KEY_STAT=`echo $j|tr -d "[0-9]"|tr -d "-"|tr -d " "`
			if [ ! -z "$KEY_STAT" ];then continue;fi
			echo $j |grep '-' >/dev/null
			if [ $? -eq 0 ];then NUM_START=`echo $j|awk -F '-' '{print $1}'`;NUM_END=`echo $j|awk -F '-' '{print $2}'`;NUM=`seq $NUM_START $NUM_END|tr "\r" " "|tr "\n" " "`;	else NUM=$j;fi
			KEY_SUM="$KEY_SUM $NUM"
		done
		if [ -z "`echo $KEY_SUM|tr -d ' '`" ];then echo "序号输入错误!";continue;else	echo "要删除的序列：`echo $KEY_SUM|xargs -n1|sort -n|xargs`";fi
		read -p "请确认序列项(Y/N)任意键为Y :" YN
		echo $YN|grep -i N >/dev/null
		if [ $? -eq 0 ];then continue;fi
		echo "开始倒序删除："
		for q in `echo $KEY_SUM|xargs -n1|sort -rn`
		do

			LINE_VAR=`iptables -nL INPUT --line |grep ^"$q "`
			if [ -z "$LINE_VAR" ];then 
				echo "TIP:不存在${q}序号或已被删除，跳过删除操作!"
			else
				echo "执行操作："
				echo "正在删除：${q}序列记录：  $LINE_VAR"
				iptables -D INPUT $q >/dev/null
				if [ $? -eq 0 ];then echo "Success,${q}序列记录删除操作成功。";else echo "Error!${q}序列记录删除操作失败！请确认权限！";fi
			fi
		done
		;;

		4)
		IPTABLES_FILE=/etc/iptables.rules
		RC_LOCAL=/etc/rc.local
		iptables-save > $IPTABLES_FILE
		if [ ! $? -eq 0 ];then echo "ERROR!iptables-save保存到${IPTABLES_FILE}导入失败！请确认权限！";continue;fi
		EXIT_LN=`cat -n $RC_LOCAL|awk '{print $0,$1}'|awk '$1=null;{print}'|grep -v ^#|awk '$1=="exit" {print}' |awk '$2=="0" {print}'|awk '{print $NF}'`
		if [ -z "$EXIT_LN" ];then EXIT_LN='$';fi
		sed -i "${EXIT_LN}i iptables-restore < ${IPTABLES_FILE} "  $RC_LOCAL
		if [ ! $? -eq 0 ];then echo "ERROR!${RC_LOCAL}追加启动失败！请确认权限！";continue;fi
		chmod +x ${RC_LOCAL}
		cat ${RC_LOCAL}|grep "iptables-restore < ${IPTABLES_FILE}" >/dev/null
		if [ $? -eq 0 ];then echo "Success,iptables-save保存到${RC_LOCAL}开机启动成功。";else echo "Error!iptables-save保存到${RC_LOCAL}开机启动失败！";fi
		;;


		0)
		exit
		;;


		*)
		echo "------ 参数输入错误！------"
		;;


esac
done


# 保存
# iptables-save > /etc/iptables.conf
# 恢复
# iptables-restore < /etc/iptables.rules

# iptables-restore < /etc/iptabels.rules
